Hello everyone,
SNMP input plugin doesn't include (for the moment) an option to split SNMP table :
indexed documents looks like this :
{
"_index": "XXXX-2020.03.17",
"_type": "doc",
"_id": "Puby6XABeaR9KJCdhk0N",
"_version": 1,
"_score": null,
"_source": {
"type": "snmp",
"host": "XXXXXXXXXX",
"XXXX-alarms": [
{
"1": 1,
"2": "1.3.6.1.4.1.8708.2.30.2.3.1.1.2.1.76",
"3": "1.3.6.1.4.1.8708.2.30.2.3.1.1.2.1.76",
"4": "XXXXXXXXXX",
"5": 0,
"6": 0,
"7": 0,
"8": 0,
"9": "L2 service operation status is down",
"10": 5,
"11": "XXXXXXX2b:00:00",
"12": "07:e4:01:1fXXXXXXXXXX00:00",
"13": 1,
"14": "XXXXXXXXXXX",
"15": "0.0.0.0",
"index": "1"
},
{
"1": 2,
"2": "1.3.6.1.4.1.8708.2.5.2.5.1.0",
"3": "1.3.6.1.4.1.8708.2.5.2.5.7.0",
"4": "upload",
"5": 0,
"6": 0,
"7": 1,
"8": 4,
"9": "Upload failed",
"10": 4,
"11": "XXXXXXXXXX00",
"12": "07:e4:01:XXXXXXXXXX00",
"13": 2,
"14": "XXXXXXXXXX",
"15": "XXXXXXXXXX",
"index": "2"
},
{
"1": 3,
"2": "0.0",
"3": "1.3.6.1.4.1.8708.2.1.2.7.8.0",
"4": "XXX",
"5": 0,
"6": 0,
"7": 0,
"8": 0,
"9": "The FTP access to get PM from the node failed",
"10": 4,
"11": "0XXXXXXXXXX00:00",
"12": "07:eXXXXXXXX:00:00",
"13": 3,
"14": "XXXXXXXXX",
"15": "XXXXXX",
"index": "3"
}
],
"message": "infinera alarms list",
"@version": "1",
"@timestamp": "2020-03-17T19:22:30.169Z"
},
"fields": {
"@timestamp": [
"2020-03-17T19:22:30.169Z"
]
},
"sort": [
1584472950169
]
}
With a logstash conf similar to :
input {
snmp {
mib_paths => ["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-snmp-1.2.1/lib/mibs/infinera/"]
hosts => [{host => "udp:XXXXXXXX/161" community => "XXXXXXX" retries => 2 timeout => 30}]
oid_root_skip => 13
tables => [
{
name => "alarms"
columns => [
".1.3.6.1.4.1.8708.2.1.2.2.1.1.1",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.2",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.3",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.4",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.5",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.6",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.7",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.8",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.9",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.10",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.11",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.12",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.13",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.14",
".1.3.6.1.4.1.8708.2.1.2.2.1.1.15"
]
}
]
type => "snmp"
interval => 30
}
}
output {
elasticsearch {
hosts => ["http://es-cluster-0:9200","http://es-cluster-1:9200","http://es-cluster-2:9200","http://es-cluster-3:9200"]
index => "xxxxxx-%{+YYYY.MM.dd}"
codec => "json"
}
}
Someone has an idea of how to etract with KV filter or Split filter each table line into a document ?
Thanks for your help.